Contactless smart cards—such as bank cards and access control badges—have become ubiquitous due to their convenience and speed. These systems rely on Near Field Communication (NFC), a short-range wireless technology that operates within a few centimeters. EMVCo specified the payment protocol for this technology following the widespread adoption of the EMV contact card protocol. The term ‘contact’ may be misleading in this context; it means the cardholder must insert the card into the terminal, whereas ‘contactless’ refers to the technology in which the cardholder only needs to place the card near the terminal or briefly tap it against the reader.
While this limited range is often considered a security feature, it is precisely this assumption that relay attacks exploit, especially when combined with modern smartphones. From the early days of contactless card deployments, relay attacks were recognized as a potential risk. A relay attack is a form of man-in-the-middle attack in which communication between a contactless card and a reader is intercepted and relayed over a longer distance. Instead of breaking cryptographic protections, the attacker simply forwards messages between the legitimate card and the terminal in real time. As a result, both sides believe they are communicating directly with each other.
Ancient scenarios
To better understand the attack, imagine the following scenario: when you tap your card to a terminal, someone places a relay device between the terminal and your card. This relay device communicates with your card as if it were the terminal and communicates with the terminal as if it were your card. So, your card could unknowingly authorize a payment at a completely different terminal. Although relay attacks may seem complex, they historically played only a limited role in overall payment card fraud.
Despite the technological requirements, the card schemes have developed their own protection technologies. We at CARDSPOT have continuously monitored these cardholder protection initiatives and mandates on behalf of our customers.
Mobile phone roles
Mobile phones, though, have significantly lowered the barrier to executing such attacks. Modern smartphones are equipped with NFC chips and internet connectivity, allowing them to act as either a card emulator or a reader. Research has demonstrated that NFC-enabled smartphones can serve as relay devices without specialized hardware, effectively turning widely available consumer devices into attack tools.
In a typical mobile-based relay scenario, two smartphones are used. One phone, placed near the victim’s contactless card (for example, in a crowded area), reads the card’s NFC signals. These signals are then transmitted over the internet to a second phone located near a payment terminal. The second device emulates the card and completes the transaction. From the terminal’s perspective, the transaction appears legitimate, even if the actual card is far away—potentially in another city or country.
Recent real-world attacks have shown how this technique can be integrated into malware. For instance, modified versions of tools like NFCGate can trick users into installing malicious applications that access NFC functionality. Victims may be socially engineered into tapping their card against their phone, unknowingly enabling the relay process. The modified NFCGate software may relay NFC communication to a remote system connected to a payment terminal. The terminal can then initiate a payment as if the original card were physically present. The payment may be completed successfully without the cardholder being informed. In more advanced “reverse relay” attacks, the victim’s phone acts as a payment card on behalf of the attacker, further expanding the threat landscape.
Improvements needed
One of the key challenges in defending against relay attacks is their stealthy nature. Since the attacker does not alter the transmitted data, traditional cryptographic protections remain intact, making detection difficult. Proposed countermeasures include distance-bounding protocols that measure communication timing to verify that the card is physically nearby, as well as context-aware techniques such as ambient sensing. However, these solutions are still an active area of research and are not universally deployed.
In conclusion, the combination of contactless technology and smartphones has created a powerful but potentially vulnerable ecosystem. While relay attacks do not break encryption, they exploit fundamental assumptions about proximity, underscoring the need for stronger security mechanisms and greater user awareness.
Sources
NFC relay attacks explained
Overview of RFID/NFC-based relay attacks (ScienceDirect)
Practical implementation of NFC relay attacks (IACR paper)
Relaying the message on relay fraud
Contactless Credit Cards Payment Fraud Protection by Ambient Authentication
Images: Flóra Nika
